# proxmox.yaml.example - Hetzner dedicated server target
#
# Hetzner bare metal server with Proxmox, accessed via WireGuard tunnel.
# Copy to proxmox.yaml and edit with your actual credentials.
#
# Network: Private bridge vmbr1 (10.10.0.0/24), no VLANs needed.
#   Proxmox host is the gateway (10.10.0.1) with NAT masquerading.
#   Access from workstation via WireGuard tunnel (10.10.99.0/24).
#
# Storage: local-zfs (ZFS pool on dedicated disks).
#
# See envs/hetzner/setup/hetzner-setup.md for the full setup guide.

host: 10.10.0.1               # Proxmox host IP (via WireGuard, on vmbr1)
method: api                    # api recommended (WireGuard may add SSH latency)
api_token_id: automation@pve!deploy
api_token_secret: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx  # token secret (overrides env PROXMOX_TOKEN_SECRET)
node: pve                      # Proxmox node name (adjust if different)
storage: local-zfs             # VM disk storage (ZFS pool)
iso_storage: local             # ISO/image storage
bridge: vmbr1                  # Private bridge (10.10.0.0/24)
# vlan:                        # No VLAN needed (dedicated private bridge)
gateway: 10.10.0.1             # Proxmox host is the gateway
dns: 10.10.0.1                 # Proxmox host forwards DNS (or use 1.1.1.1)
pool: IncusLab                 # Resource pool
ssh_user: root                 # SSH user (for ssh method fallback)